Tembeya Shop

Privacy Policy

1. Introduction

Tembeya Shop ("we", "our", or "us") is committed to protecting your privacy and personal information across all our platforms, including our website (tembeya.shop and tembeya.ug), mobile applications (iOS and Android), and all related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services in Uganda.

By using Tembeya Shop's website, mobile applications, and services, you agree to the collection and use of information in accordance with this policy, which complies with the Uganda Data Protection Act, 2019 and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide to us, including:

  • Account Information: Full name, email address, phone number, date of birth, profile picture
  • Address Information: Billing and delivery addresses, city, district, postal code, GPS coordinates
  • Payment Information: Mobile money details (MTN, Airtel), card information (processed securely), bank account details
  • Vendor Information: Business name, URSB registration number, tax identification number (TIN), business address, bank details, KYC documents
  • Profile Information: Bio, preferences, settings, device information
  • Device Location: GPS coordinates for delivery accuracy and location-based services

2.2 Transaction Information

We collect information about your transactions and activities on our platform:

  • Order history and details
  • Payment and billing information
  • Shipping and delivery information
  • Product views, searches, and browsing history
  • Cart contents and wishlist items
  • Reviews and ratings submitted
  • Customer support communications (chats, emails, tickets, calls)

2.3 Device and Technical Information

We automatically collect technical information when you access our services via website or mobile app:

  • IP address and location information
  • Browser type, version, and language
  • Operating system and device type
  • Mobile device identifier (IMEI, IDFA, GAID for apps)
  • App version and build number
  • Referring website and search terms
  • Pages viewed and time spent on each page
  • Click paths and navigation patterns
  • Screen recordings and screenshots (for technical support only)
  • Heat map data (for user experience optimization)

2.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing behavior:

  • Session Cookies: Temporary cookies that expire when you close your browser or app
  • Persistent Cookies: Cookies that remain on your device for a set period
  • Analytics Cookies: Cookies that help us understand how you use our site
  • Marketing Cookies: Cookies used to deliver personalized advertisements
  • Third-Party Cookies: Cookies set by our partners (Google Analytics, Mixpanel, OneSignal, etc.)

You can control cookie preferences through our cookie banner or your browser settings. For mobile apps, you can control tracking in your device settings.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Provision: To process orders, deliver products, and provide customer support
  • Account Management: To create and manage your account, authenticate you, and provide personalized experiences
  • Payment Processing: To process payments, prevent fraud, and issue refunds
  • Communication: To send order confirmations, shipping notifications, OTP codes, and promotional communications (with your consent)
  • Security: To detect, prevent, and address fraud, abuse, and security issues
  • Analytics: To analyze usage patterns, improve our services, and develop new features
  • Marketing: To send personalized offers, recommendations, and advertisements (with your consent)
  • Legal Compliance: To comply with legal obligations, respond to legal requests, and protect our rights
  • Vendor Services: To facilitate vendor operations, process commissions, and provide analytics
  • Location Services: To provide accurate delivery, find nearby vendors, and offer location-based features
  • Technical Support: To provide customer support through live chat, email, tickets, and voice calls

We will not use your personal information for purposes other than those described in this policy without your prior consent, except as required or permitted by law.

4. Third-Party Service Providers

We share your information with the following third-party service providers to provide our services:

4.1 ZuriHub - Customer Support

We use ZuriHub to provide customer support through multiple channels:

  • Live Chat: Real-time chat support on our website and mobile app
  • Email Support: Email ticketing system for customer inquiries
  • Ticket Management: Support ticket tracking and resolution
  • Social Media Integration: Support through Facebook, Twitter, Instagram, and WhatsApp
  • Voice Calls: Phone support integration for voice communication

Data Shared with ZuriHub:

  • Name and contact information (email, phone number)
  • Order and transaction history for context
  • Chat transcripts and support tickets
  • Email content for OTP and transactional emails
  • Phone numbers for voice call support
  • Session information for technical support

Purpose of Data Sharing:

  • Provide responsive customer support across all channels
  • Send OTP codes via email and SMS for authentication
  • Send transactional emails (order confirmations, shipping notifications)
  • Track and resolve customer support tickets
  • Provide voice call support for complex issues
  • Maintain support history for better customer service

ZuriHub is bound by strict confidentiality and data protection agreements. They do not use your data for any purpose other than providing customer support services on our behalf.

4.2 Flutterwave - Payment Processing

We use Flutterwave to process payments, refunds, and manage financial transactions:

  • Payment Processing: MTN Mobile Money, Airtel Money, card payments, bank transfers
  • Refund Processing: Automated refund processing to original payment methods
  • Fraud Detection: Real-time fraud detection and prevention
  • Transaction Management: Transaction tracking and reconciliation

Data Shared with Flutterwave:

  • Email address for payment confirmation and receipts
  • Session information for secure payment processing
  • Full name as shown on payment method
  • Reason for payment (order description, purpose)
  • Mobile contact number for mobile money payments
  • Payment amount and currency (UGX)
  • Transaction reference and order number

Purpose of Data Sharing:

  • Process payments securely and efficiently
  • Verify payment authenticity and prevent fraud
  • Send payment confirmations and receipts
  • Process refunds to original payment methods
  • Comply with financial regulations and PCI DSS standards
  • Maintain transaction records for reconciliation

Flutterwave is PCI DSS Level 1 certified and adheres to the highest security standards for payment processing. Your payment information is encrypted and processed securely.

4.3 Google Analytics - Website and App Analytics

We use Google Analytics to analyze website and mobile app traffic:

  • Traffic Analysis: Track visitor numbers, page views, and user sessions
  • User Behavior: Analyze navigation patterns, popular pages, and user flows
  • Performance Monitoring: Monitor website and app performance and load times
  • Conversion Tracking: Track user conversions and sales funnels

Data Shared with Google Analytics:

  • Anonymous user ID (no personal identifiers)
  • Device type and browser information
  • Geographic location (country, city level)
  • Pages visited and time spent on each page
  • Referral sources and search terms
  • App version and device information for mobile apps

Purpose of Data Sharing:

  • Improve website and app performance
  • Understand user behavior and preferences
  • Optimize user experience and interface
  • Measure marketing campaign effectiveness
  • Identify and fix technical issues

Google Analytics anonymizes IP addresses and does not store personal information. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

4.4 Mixpanel - User Analytics and Event Tracking

We use Mixpanel for advanced user analytics and event tracking:

  • Event Tracking: Track specific user actions (add to cart, checkout, etc.)
  • User Segmentation: Segment users based on behavior and preferences
  • Funnel Analysis: Analyze conversion funnels and drop-off points
  • Cohort Analysis: Track user retention and engagement over time

Data Shared with Mixpanel:

  • Anonymous user ID (no personal identifiers)
  • Event names and properties (e.g., "add_to_cart", product_id)
  • Device and browser information
  • Geographic location (country, city level)
  • App version and device information for mobile apps

Purpose of Data Sharing:

  • Understand user behavior and preferences
  • Optimize product features and user flows
  • Improve conversion rates and user retention
  • Personalize user experience
  • A/B test new features and improvements

Mixpanel anonymizes data and does not store personal information. We use Mixpanel in compliance with their privacy policy and applicable data protection laws.

4.5 Advertising Partners

We work with advertising partners to display relevant advertisements on our platform:

  • Google AdSense: Display advertising program that shows relevant ads based on your browsing behavior
  • Facebook Ads: Retargeting and social advertising campaigns
  • Third-Party Ad Networks: Additional ad networks for banner and sponsored content

Data Shared with Advertising Partners:

  • Cookies and device identifiers (non-personally identifiable)
  • Browsing behavior and interests (categorized)
  • Demographic information (age, gender, location - aggregated)
  • Ad impression and click data
  • Conversion data (when you make a purchase after clicking an ad)

Purpose of Data Sharing:

  • Show relevant advertisements based on your interests
  • Measure advertising effectiveness and ROI
  • Prevent ad fraud and abuse
  • Optimize ad delivery and targeting

Your Advertising Privacy Rights:

  • You can opt out of personalized advertising through your browser settings
  • You can use the Digital Advertising Alliance's opt-out tools (http://www.aboutads.info/choices)
  • You can reset your advertising ID in your device settings (mobile apps)
  • You can disable cookies in your browser settings
  • Opting out does not mean you will see fewer ads, but the ads may be less relevant

Our advertising partners are bound by their own privacy policies and data protection agreements. We do not share personally identifiable information (name, email, phone) with advertising partners unless you explicitly consent.

4.6 OneSignal - Push Notifications

We use OneSignal to send push notifications to mobile app users:

  • Order Updates: Notify users about order status changes
  • Promotional Notifications: Send promotional offers and discounts (with consent)
  • Account Alerts: Notify users about account activity and security
  • Delivery Notifications: Notify users about delivery status

Data Shared with OneSignal:

  • Device token for push notification delivery
  • User preferences for notification types
  • Anonymous user ID (no personal identifiers)
  • Device type and platform (iOS/Android)

Purpose of Data Sharing:

  • Send timely order and delivery updates
  • Send promotional notifications (with user consent)
  • Improve user engagement and retention
  • Provide better user experience through notifications

Users can opt out of push notifications at any time through their device settings or the app's notification preferences.

4.7 ZuriHub - Live Traffic, Heat Maps, and Screen Recordings

We use ZuriHub's technical support tools to monitor live traffic, generate heat maps, and capture screen recordings for technical support:

  • Live Traffic Monitoring: Real-time monitoring of website and app traffic
  • Heat Maps: Visual representation of user clicks and scrolling behavior
  • Screen Recordings: Recordings of user sessions for technical support and debugging
  • Screenshots: Automated screenshots of error states for troubleshooting
  • Session Replay: Replay of user sessions to identify and fix issues

Data Shared with ZuriHub:

  • Anonymous session ID (no personal identifiers)
  • Click coordinates and mouse movements
  • Scroll depth and page interactions
  • Screen recordings of user sessions (without personal data)
  • Screenshots of error states
  • Device and browser information

Purpose of Data Sharing:

  • Identify and fix technical issues quickly
  • Understand user behavior and improve UX
  • Optimize website and app performance
  • Provide better technical support
  • Debug and resolve user-reported issues

ZuriHub is bound by strict confidentiality and data protection agreements. Screen recordings and screenshots are only used for technical support and debugging. They are not shared with third parties and are deleted after 30 days. Personal information is not included in recordings.

5. Information Sharing and Disclosure

We may share your information with the following parties:

5.1 Vendors

When you place an order, we share necessary information with the relevant vendor to fulfill your order:

  • Your name and delivery address
  • Order details and product information
  • Contact information for delivery coordination
  • GPS coordinates for delivery accuracy

We do not share your payment information with vendors. All payments are processed through Tembeya Shop's secure payment system.

5.2 Payment Processors

We share payment information with our payment processing partners to process transactions:

  • Flutterwave for MTN Mobile Money, Airtel Money, and card payments
  • Banks for bank transfers and withdrawals

These partners are bound by strict confidentiality and data protection obligations.

5.3 Delivery Partners

We share delivery information with our delivery partners to ship your orders, including your name, address, phone number, and GPS coordinates for accurate delivery.

5.4 Legal Requirements

We may disclose your information when required by law or to protect our rights:

  • Comply with legal obligations, court orders, or government requests
  • Protect our rights, property, or safety, or that of our users
  • Prevent or investigate fraud, security issues, or illegal activities
  • Enforce our Terms and Conditions

We do not sell your personal information to third parties for their marketing purposes.

5.5 Advertising and Sponsored Content Data

When you interact with advertisements on Tembeya Shop, we collect the following data:

  • Ad Impressions: When an advertisement is displayed to you
  • Ad Clicks: When you click on an advertisement
  • Ad Engagement: How long you view an advertisement, scroll behavior
  • Conversion Data: Whether you made a purchase after clicking an ad
  • Ad Type: The type of ad you interacted with (banner, sponsored product, etc.)
  • Placement: Where the ad was displayed (homepage, product page, etc.)

Purpose of Advertising Data Collection:

  • Measure advertising effectiveness and ROI for vendors
  • Optimize ad placement and targeting
  • Prevent ad fraud and abuse
  • Improve user experience by showing relevant ads
  • Calculate billing for advertisers based on impressions and clicks

How Advertising Data is Used:

  • Ad impression and click data is aggregated and reported to vendors for performance tracking
  • Vendors can see how many times their ads were viewed and clicked
  • Vendors can see conversion rates and ROI for their advertising campaigns
  • Personal information (name, email, phone) is NOT shared with advertisers
  • Anonymous user IDs and aggregated data are used for reporting

Third-Party Advertising:

  • When you click on third-party advertisements (e.g., Google AdSense), you may be redirected to external websites
  • External websites have their own privacy policies and data collection practices
  • Tembeya Shop is not responsible for the privacy practices of external websites
  • We encourage you to review the privacy policies of any external websites you visit

Advertising data is retained for 90 days for billing and performance reporting purposes. After this period, data is anonymized or deleted.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy:

  • Account Information: Retained while your account is active and for a reasonable period after account closure
  • Transaction Information: Retained for 7 years to comply with tax and legal requirements
  • Communication Logs: Retained for 90 days for customer support purposes
  • KYC Documents: Retained for 180 days and automatically deleted after 180 days
  • Analytics Data: Retained in anonymized form for analytical purposes
  • Screen Recordings: Retained for 30 days and then automatically deleted
  • Heat Map Data: Retained for 90 days and then deleted
  • Session Data: Retained for 30 days and then deleted

When we delete your information, we take reasonable steps to ensure it is permanently deleted from our systems and cannot be recovered. KYC documents are automatically deleted after 180 days from submission, and no manual intervention is required.

7. Data Security

We implement appropriate technical and organizational measures to protect your information:

  • Encryption: All sensitive data is encrypted in transit and at rest using industry-standard encryption (AES-256)
  • Secure Servers: Our servers are hosted in secure data centers with physical security measures
  • Access Controls: Access to personal information is restricted to authorized personnel only
  • Regular Audits: We conduct regular security audits and vulnerability assessments
  • PCI DSS Compliance: We comply with Payment Card Industry Data Security Standards for card payments
  • Data Minimization: We collect only the information necessary for our services
  • App Security: Mobile apps use certificate pinning and secure communication protocols

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights

Under the Uganda Data Protection Act, 2019, you have the following rights regarding your personal information:

  • Right to Access: Request access to the personal information we hold about you
  • Right to Correction: Request correction of inaccurate or incomplete information
  • Right to Deletion: Request deletion of your personal information (subject to legal and business requirements)
  • Right to Restrict Processing: Request restriction of processing of your information
  • Right to Data Portability: Request transfer of your information to another service
  • Right to Object: Object to processing of your information for certain purposes
  • Right to Withdraw Consent: Withdraw consent for marketing communications at any time
  • Right to Opt Out: Opt out of analytics tracking, push notifications, and marketing communications

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

Note that certain information must be retained for legal, regulatory, or business purposes, and may not be eligible for deletion.

9. Mobile Application Privacy

This Privacy Policy applies to our mobile applications (iOS and Android) as well as our website. Additional mobile-specific privacy practices include:

  • Device Permissions: We only request permissions necessary for app functionality (camera for product photos, location for delivery, notifications for updates)
  • Push Notifications: You can control push notifications in your device settings or app preferences
  • Location Services: GPS location is used only for delivery accuracy and location-based features with your consent
  • App Analytics: Anonymous usage data is collected to improve app performance and user experience
  • Local Storage: Some data is stored locally on your device for offline functionality and performance

You can manage app permissions and privacy settings through your device's system settings.

10. Children's Privacy

Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

Parents and guardians should monitor their children's use of our services and contact us if they believe their child has provided us with personal information.

11. International Data Transfers

Your information is primarily stored and processed in Uganda. We may transfer your information to other countries for the purposes described in this policy, provided that adequate safeguards are in place to protect your information in accordance with applicable data protection laws.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technology. We will notify you of significant changes by:

  • Posting the new policy on our website and mobile app
  • Sending an email notification to registered users
  • Sending a push notification to mobile app users
  • Displaying a prominent notice on our platform

Your continued use of our services after the effective date of the revised policy constitutes acceptance of the updated policy.

13. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]

Phone: +256 700 000 000

Website: https://tembeya.shop and https://tembeya.ug

Address: Kampala, Uganda

Data Protection Officer: [email protected]

Support hours: Monday-Friday 8AM-8PM, Saturday 9AM-5PM

If you believe we have not complied with your data protection rights, you may lodge a complaint with the Uganda Personal Data Protection Office.

Last updated: October 2026 - Advertising data collection and ZuriHub technical tools added